Privacy and cookies policy

Data controller

• Controller: Comercial Laranet SpA, a Chilean joint-stock company (trading as Cerebros). For CRM data, see “CRM data we process on behalf of businesses”.
• Tax ID (RUT): 78.192.216-1
• Address: San Francisco 1070, office 14, Puerto Varas, Chile
• Privacy contact: hola@cerebros.agency
• EU representative (Article 27 GDPR): Efraín Pineda, in Spain. Contact: hola@cerebros.agency

What data we process and why

• Booking a conversation: If you book through the “Book a conversation” button, Google Calendar collects your name, your email and anything you choose to write in the form. We use it to prepare and hold the meeting and to reply to what you raise. Legal basis: taking steps at your request before a possible contract (Article 6(1)(b) GDPR).
• Emails to hola@cerebros.agency: We process your address, your name and the content of your message to reply. Legal basis: pre-contractual steps at your request when you ask about our services (Article 6(1)(b)), and our legitimate interest in answering other messages (Article 6(1)(f)).
• Visit statistics: We use Umami Cloud to count visits and clicks on the booking button. It uses no cookies and stores nothing on your device, and we only see aggregate figures: page views, country, browser and device type, and referring page. Legal basis: our legitimate interest in knowing which parts of the site are useful (Article 6(1)(f)).
• Running and securing the site: Cloudflare hosts and delivers the site. To do so, and to protect it from abuse, it processes technical connection data such as your IP address. The fonts are also served by Cloudflare from our own domain. Legal basis: our legitimate interest in keeping the site available and secure (Article 6(1)(f)).

If you visit this site, we make no automated decisions about you and build no profiles.

Business outreach

We write to businesses that have not contacted us before to offer them our services. We do it by email or WhatsApp, using the address or number the business itself publishes on its website or in its ads.

• What we keep: The business name, its city and sector, the email address or phone number it publishes, its website and the tools it uses there (for example online booking, WhatsApp or ad measurement), and what it advertises and since when. If the same source names a contact person, we note that name too. We also record the date of each message and the reply.
• Where it comes from: Public sources: the business’s own website, its ads, which we look up in the Meta Ad Library, and its Google Maps listing, which we use to find businesses and reach their website. From Google Maps we only keep the listing’s identifier. We review these sources before writing so that the message is relevant to what the business does.
• What we use it for: To offer our services and, if there is interest, arrange a conversation. Legal basis: our legitimate interest in making our services known to other businesses (Article 6(1)(f) GDPR). We only write to the contact channels the business publishes, and only about services related to what it does.
• Retention: If there is no reply, we delete the data and the messages 6 months after the last message we sent. If the business replies without asking us to stop, we keep the data and the conversation for 12 months after the last contact, or for as long as the relationship lasts if it becomes a client, as under “How long we keep it”.
• How to stop the messages: If a business does not want further messages, it can object at any time, without giving a reason: reply “no” to any of our messages, by email or WhatsApp, or write to hola@cerebros.agency. From that moment we stop writing to it and, within 7 days at most, delete its data and the messages, except its email addresses, its phone numbers and the date of the request. Those go on an exclusion list that we keep for as long as we do outreach and use only to honour the objection.

We make no automated decisions and build no profiles of individuals. We use AI tools to look up those sources and draft the messages; a person reads and approves them before they are sent.

CRM data we process on behalf of businesses

Cerebros makes a CRM tailored to each business. The businesses that use it keep in it the WhatsApp conversations and the contact details of the people who write to them. This section explains how that data is processed.

• Who is responsible: For that data, the controller is the business that uses the CRM. Cerebros processes it on the business’s behalf and does not use it for its own purposes beyond what is needed to provide the service and keep it secure. Only synthetic data is used to test and improve the service, not real conversations of the people who write to the businesses.
• If you wrote to a business: Send your requests for access, correction, erasure or other rights over that data to that business. Cerebros assists the business in handling them. If you write to us instead, tell us which business you wrote to and we will pass your request on.
• Where and with whom: Each business works in its own space. The CRM’s data is stored in the United States and is processed by the AI and infrastructure providers Cerebros uses to run the service. Messages travel through WhatsApp, a Meta service that processes them under its own terms and may do so outside Chile and the European Economic Area.
• Automatic replies: An AI agent handles enquiries with the information the business approved and is built to hand to a person what needs judgement. The business can take over the conversation whenever it wants and hand it back to the agent.
• Sensitive data: Conversations may include sensitive data, such as health information, depending on what each person writes. The business is responsible for having a legal basis to process that data.
• How long it is kept: The business, as controller, sets how long that data is kept.

What the rest of this policy says about people who visit the site, write to us, receive our outreach or are members of a business’s team who use the CRM (account and access data) does not change: in those cases, Cerebros is the controller.

How long we keep it

Booking and email data from people who do not become clients is kept for 12 months after the last contact and then deleted. If an engagement is signed, it is kept for as long as the relationship lasts and then for the periods required by tax and legal obligations.

Umami statistics are aggregate and cannot identify you. Cloudflare keeps technical data under its own retention policy.

Who can access it

We do not sell your data. Nor do we hand it to third parties for their own purposes, except as explained below for WhatsApp. The providers we need to run the service can access the data covered by this policy. Google, Cloudflare and Umami Software, Inc. act as processors under the contract required by Article 28 GDPR. The CRM providers process the CRM data on behalf of the business, as explained under “CRM data we process on behalf of businesses”:

• Google: Google Workspace and Google Calendar: calendar, bookings and email.
• Cloudflare: hosting, delivery and security of the site.
• Umami Software, Inc.: visit statistics.
• CRM infrastructure providers: storage and operation of the CRM, with the data stored in the United States.
• CRM AI providers: processing of CRM conversations with artificial intelligence.

If we write to you on WhatsApp, the message goes through that Meta service, which processes it under its own terms and privacy policy and may do so outside Chile and the European Economic Area.

International transfers

Comercial Laranet SpA processes data in Chile, which has no adequacy decision from the European Commission. If you are in the European Union, your data reaches us directly from you when you book a conversation or write to us.

Google and Cloudflare are US companies and may process data outside Chile and the European Economic Area. Both are certified under the EU-US Data Privacy Framework, which the European Commission has found to provide an adequate level of protection.

Umami Software, Inc. is also based in the United States. Transfers to Umami rely on the standard contractual clauses approved by the European Commission, included in its data processing agreement.

The CRM’s data is stored in the United States. The AI and infrastructure providers Cerebros uses for the CRM may process it there or in other countries, outside Chile and the European Economic Area.

Your rights

You can ask for access to your data, its correction or erasure, restriction or temporary blocking of processing and portability, and you can object to processing based on legitimate interest and, without giving any reason, to business outreach. Write to hola@cerebros.agency saying which right you want to exercise; if you are in the European Union, you can also contact our EU representative. If there is reasonable doubt about your identity, we will ask you to confirm it. We reply within one month. If your data is in a business’s CRM, address your request to that business, as explained under “CRM data we process on behalf of businesses”.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority in your country. If you are in Chile, you can go to the civil courts under Law No. 19,628 on the protection of private life and, to the extent its amendment by Law No. 21,719 applies, to the Personal Data Protection Agency.

Cookies and storage on your device

This site uses a single first-party cookie and no third-party cookies. It is called “lang” and stores your language (Spanish or English) only when you choose one in the language switch, so the home page opens in that language next time; it lasts up to one year or until you delete it, and we use it for nothing else. Separately, when you choose the light or dark theme, your browser keeps it in local storage (key “cerebros-look”) and it is never sent to a server. Both are preferences you choose and only serve to show you the site the way you asked, so they need no consent (as a reference point, Article 22.2 of the Spanish LSSI-CE and the AEPD cookie guidance). You can clear them in your browser settings.

If you have not chosen a language, when delivering the home page we use the country Cloudflare associates with your IP address (see “Running and securing the site”) only to send you to the Spanish or English version; we do not store or log that country, and nothing is stored on your device. Legal basis: our legitimate interest in showing you the site in a language you are likely to understand (Article 6(1)(f)). You can switch language at any time with the language switch and object by writing to us; if you delete the cookie, this detection applies again.

The booking page belongs to Google and applies its own cookie policy.

Changes to this policy

If we add a service that processes data differently, we will update this page before switching it on.